| 1 | plugin_name: go.d.plugin |
| 2 | modules: |
| 3 | - meta: |
| 4 | id: collector-go.d.plugin-k8s_apiserver |
| 5 | plugin_name: go.d.plugin |
| 6 | module_name: k8s_apiserver |
| 7 | monitored_instance: |
| 8 | name: Kubernetes API Server |
| 9 | link: https://kubernetes.io/docs/concepts/overview/components/#kube-apiserver |
| 10 | icon_filename: kubernetes.svg |
| 11 | categories: |
| 12 | - data-collection.containers-and-vms |
| 13 | keywords: |
| 14 | - kubernetes |
| 15 | - k8s |
| 16 | - apiserver |
| 17 | - kube-apiserver |
| 18 | related_resources: |
| 19 | integrations: |
| 20 | list: |
| 21 | - plugin_name: go.d.plugin |
| 22 | module_name: k8s_kubelet |
| 23 | - plugin_name: go.d.plugin |
| 24 | module_name: k8s_kubeproxy |
| 25 | - plugin_name: go.d.plugin |
| 26 | module_name: k8s_state |
| 27 | - plugin_name: cgroups.plugin |
| 28 | module_name: /sys/fs/cgroup |
| 29 | monitored_instance_name: "Kubernetes Containers" |
| 30 | - plugin_name: go.d.plugin |
| 31 | module_name: coredns |
| 32 | info_provided_to_referring_integrations: |
| 33 | description: "" |
| 34 | overview: |
| 35 | data_collection: |
| 36 | metrics_description: | |
| 37 | This collector monitors Kubernetes API Server health, performance, and request metrics. |
| 38 | |
| 39 | It collects metrics from the kube-apiserver's `/metrics` endpoint, providing insights into: |
| 40 | - Request rates, latencies, and error rates |
| 41 | - Current inflight and long-running requests |
| 42 | - Admission controller and webhook performance |
| 43 | - etcd backend health and object counts |
| 44 | - Controller work queue depths and latencies |
| 45 | - Authentication and audit events |
| 46 | - Go runtime and process metrics |
| 47 | method_description: | |
| 48 | The collector scrapes Prometheus-format metrics from the Kubernetes API Server's metrics endpoint. |
| 49 | Authentication is typically done using a ServiceAccount bearer token. |
| 50 | supported_platforms: |
| 51 | include: [] |
| 52 | exclude: [] |
| 53 | multi_instance: true |
| 54 | additional_permissions: |
| 55 | description: | |
| 56 | The ServiceAccount used must have permissions to access the `/metrics` endpoint. |
| 57 | In most clusters, this requires cluster-admin or a custom ClusterRole with metrics access. |
| 58 | default_behavior: |
| 59 | auto_detection: |
| 60 | description: | |
| 61 | When running inside a Kubernetes cluster, the collector attempts to connect to |
| 62 | `https://kubernetes.default.svc:443/metrics` using the pod's ServiceAccount token. |
| 63 | limits: |
| 64 | description: "" |
| 65 | performance_impact: |
| 66 | description: "" |
| 67 | setup: |
| 68 | prerequisites: |
| 69 | list: |
| 70 | - title: ServiceAccount with metrics access |
| 71 | description: | |
| 72 | The Netdata pod must have a ServiceAccount with permissions to read metrics from the API server. |
| 73 | You can create a ClusterRole and ClusterRoleBinding for this purpose. |
| 74 | configuration: |
| 75 | file: |
| 76 | name: go.d/k8s_apiserver.conf |
| 77 | options: |
| 78 | description: | |
| 79 | The following options can be defined globally: update_every, autodetection_retry. |
| 80 | folding: |
| 81 | title: Config options |
| 82 | enabled: true |
| 83 | list: |
| 84 | - name: update_every |
| 85 | description: Data collection interval (seconds). |
| 86 | default_value: 1 |
| 87 | required: false |
| 88 | group: Collection |
| 89 | - name: autodetection_retry |
| 90 | description: Autodetection retry interval (seconds). Set 0 to disable. |
| 91 | default_value: 0 |
| 92 | required: false |
| 93 | group: Collection |
| 94 | |
| 95 | - name: url |
| 96 | description: Target endpoint URL. |
| 97 | default_value: https://kubernetes.default.svc:443/metrics |
| 98 | required: true |
| 99 | group: Target |
| 100 | - name: timeout |
| 101 | description: HTTP request timeout (seconds). |
| 102 | default_value: 2 |
| 103 | required: false |
| 104 | group: Target |
| 105 | |
| 106 | - name: username |
| 107 | description: Username for Basic HTTP authentication. |
| 108 | default_value: "" |
| 109 | required: false |
| 110 | group: HTTP Auth |
| 111 | - name: password |
| 112 | description: Password for Basic HTTP authentication. |
| 113 | default_value: "" |
| 114 | required: false |
| 115 | group: HTTP Auth |
| 116 | - name: bearer_token_file |
| 117 | description: "Path to a file containing a bearer token (used for `Authorization: Bearer`)." |
| 118 | default_value: "/var/run/secrets/kubernetes.io/serviceaccount/token" |
| 119 | required: false |
| 120 | group: HTTP Auth |
| 121 | |
| 122 | - name: tls_skip_verify |
| 123 | description: Skip TLS certificate and hostname verification (insecure). |
| 124 | default_value: no |
| 125 | required: false |
| 126 | group: TLS |
| 127 | - name: tls_ca |
| 128 | description: Path to CA bundle used to validate the server certificate. |
| 129 | default_value: "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt" |
| 130 | required: false |
| 131 | group: TLS |
| 132 | - name: tls_cert |
| 133 | description: Path to client TLS certificate (for mTLS). |
| 134 | default_value: "" |
| 135 | required: false |
| 136 | group: TLS |
| 137 | - name: tls_key |
| 138 | description: Path to client TLS private key (for mTLS). |
| 139 | default_value: "" |
| 140 | required: false |
| 141 | group: TLS |
| 142 | |
| 143 | - name: proxy_url |
| 144 | description: HTTP proxy URL. |
| 145 | default_value: "" |
| 146 | required: false |
| 147 | group: Proxy |
| 148 | - name: proxy_username |
| 149 | description: Username for proxy Basic HTTP authentication. |
| 150 | default_value: "" |
| 151 | required: false |
| 152 | group: Proxy |
| 153 | - name: proxy_password |
| 154 | description: Password for proxy Basic HTTP authentication. |
| 155 | default_value: "" |
| 156 | required: false |
| 157 | group: Proxy |
| 158 | |
| 159 | - name: method |
| 160 | description: HTTP method to use. |
| 161 | default_value: "GET" |
| 162 | required: false |
| 163 | group: Request |
| 164 | - name: body |
| 165 | description: Request body (e.g., for POST/PUT). |
| 166 | default_value: "" |
| 167 | required: false |
| 168 | group: Request |
| 169 | - name: headers |
| 170 | description: "Additional HTTP headers (one per line as key: value)." |
| 171 | default_value: "" |
| 172 | required: false |
| 173 | group: Request |
| 174 | - name: not_follow_redirects |
| 175 | description: Do not follow HTTP redirects. |
| 176 | default_value: no |
| 177 | required: false |
| 178 | group: Request |
| 179 | - name: force_http2 |
| 180 | description: Force HTTP/2 (including h2c over TCP). |
| 181 | default_value: no |
| 182 | required: false |
| 183 | group: Request |
| 184 | |
| 185 | - name: vnode |
| 186 | description: Associates this data collection job with a [Virtual Node](https://learn.netdata.cloud/docs/netdata-agent/configuration/organize-systems-metrics-and-alerts#virtual-nodes). |
| 187 | default_value: "" |
| 188 | required: false |
| 189 | group: Virtual Node |
| 190 | examples: |
| 191 | folding: |
| 192 | title: Config |
| 193 | enabled: true |
| 194 | list: |
| 195 | - name: In-cluster (default) |
| 196 | folding: |
| 197 | enabled: false |
| 198 | description: Default configuration when running inside a Kubernetes cluster. |
| 199 | config: | |
| 200 | jobs: |
| 201 | - name: local |
| 202 | url: https://kubernetes.default.svc:443/metrics |
| 203 | bearer_token_file: /var/run/secrets/kubernetes.io/serviceaccount/token |
| 204 | tls_ca: /var/run/secrets/kubernetes.io/serviceaccount/ca.crt |
| 205 | - name: External access with kubectl proxy |
| 206 | description: | |
| 207 | Access API server metrics via kubectl proxy running on localhost. |
| 208 | config: | |
| 209 | jobs: |
| 210 | - name: via-proxy |
| 211 | url: http://127.0.0.1:8001/metrics |
| 212 | - name: Direct access with token |
| 213 | description: | |
| 214 | Direct access to API server with a bearer token. |
| 215 | config: | |
| 216 | jobs: |
| 217 | - name: direct |
| 218 | url: https://api.example.com:6443/metrics |
| 219 | bearer_token_file: /path/to/token |
| 220 | tls_skip_verify: yes |
| 221 | troubleshooting: |
| 222 | problems: |
| 223 | list: |
| 224 | - name: Connection refused |
| 225 | description: | |
| 226 | The API server may not be accessible. Check that: |
| 227 | 1. The URL is correct |
| 228 | 2. Network policies allow access |
| 229 | 3. The ServiceAccount has proper RBAC permissions |
| 230 | - name: 401 Unauthorized |
| 231 | description: | |
| 232 | Authentication failed. Verify: |
| 233 | 1. The bearer token file exists and is readable |
| 234 | 2. The token is valid and not expired |
| 235 | 3. The ServiceAccount has metrics access permissions |
| 236 | - name: Certificate errors |
| 237 | description: | |
| 238 | TLS verification failed. Options: |
| 239 | 1. Provide the correct CA certificate path in `tls_ca` |
| 240 | 2. Set `tls_skip_verify: yes` (not recommended for production) |
| 241 | alerts: |
| 242 | - name: k8s_apiserver_request_errors |
| 243 | metric: k8s_apiserver.requests_by_code |
| 244 | info: "high rate of API server request errors (5xx responses)" |
| 245 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/k8s_apiserver.conf |
| 246 | - name: k8s_apiserver_latency |
| 247 | metric: k8s_apiserver.request_latency |
| 248 | info: "API server request latency is high" |
| 249 | link: https://github.com/netdata/netdata/blob/master/src/health/health.d/k8s_apiserver.conf |
| 250 | metrics: |
| 251 | folding: |
| 252 | title: Metrics |
| 253 | enabled: false |
| 254 | description: "" |
| 255 | availability: [] |
| 256 | scopes: |
| 257 | - name: global |
| 258 | description: These metrics refer to the entire monitored API server instance. |
| 259 | labels: [] |
| 260 | metrics: |
| 261 | - name: k8s_apiserver.requests_total |
| 262 | description: API Server Request Rate |
| 263 | unit: requests/s |
| 264 | chart_type: line |
| 265 | dimensions: |
| 266 | - name: requests |
| 267 | - name: k8s_apiserver.requests_dropped |
| 268 | description: API Server Dropped Requests |
| 269 | unit: requests/s |
| 270 | chart_type: line |
| 271 | dimensions: |
| 272 | - name: dropped |
| 273 | - name: k8s_apiserver.requests_by_verb |
| 274 | description: API Server Requests By Verb |
| 275 | unit: requests/s |
| 276 | chart_type: stacked |
| 277 | dimensions: |
| 278 | - name: a dimension per HTTP verb |
| 279 | - name: k8s_apiserver.requests_by_code |
| 280 | description: API Server Requests By Status Code |
| 281 | unit: requests/s |
| 282 | chart_type: stacked |
| 283 | dimensions: |
| 284 | - name: a dimension per HTTP status code |
| 285 | - name: k8s_apiserver.requests_by_resource |
| 286 | description: API Server Requests By Resource |
| 287 | unit: requests/s |
| 288 | chart_type: stacked |
| 289 | dimensions: |
| 290 | - name: a dimension per Kubernetes resource |
| 291 | - name: k8s_apiserver.request_latency |
| 292 | description: API Server Request Latency |
| 293 | unit: milliseconds |
| 294 | chart_type: line |
| 295 | dimensions: |
| 296 | - name: p50 |
| 297 | - name: p90 |
| 298 | - name: p99 |
| 299 | - name: k8s_apiserver.response_size |
| 300 | description: API Server Response Size |
| 301 | unit: bytes |
| 302 | chart_type: line |
| 303 | dimensions: |
| 304 | - name: p50 |
| 305 | - name: p90 |
| 306 | - name: p99 |
| 307 | - name: k8s_apiserver.inflight_requests |
| 308 | description: API Server Inflight Requests |
| 309 | unit: requests |
| 310 | chart_type: stacked |
| 311 | dimensions: |
| 312 | - name: mutating |
| 313 | - name: read_only |
| 314 | - name: k8s_apiserver.longrunning_requests |
| 315 | description: API Server Long-Running Requests |
| 316 | unit: requests |
| 317 | chart_type: line |
| 318 | dimensions: |
| 319 | - name: longrunning |
| 320 | - name: k8s_apiserver.rest_client_requests_by_code |
| 321 | description: REST Client Requests By Status Code |
| 322 | unit: requests/s |
| 323 | chart_type: stacked |
| 324 | dimensions: |
| 325 | - name: a dimension per HTTP status code |
| 326 | - name: k8s_apiserver.rest_client_requests_by_method |
| 327 | description: REST Client Requests By Method |
| 328 | unit: requests/s |
| 329 | chart_type: stacked |
| 330 | dimensions: |
| 331 | - name: a dimension per HTTP method |
| 332 | - name: k8s_apiserver.rest_client_latency |
| 333 | description: REST Client Request Latency |
| 334 | unit: milliseconds |
| 335 | chart_type: line |
| 336 | dimensions: |
| 337 | - name: p50 |
| 338 | - name: p90 |
| 339 | - name: p99 |
| 340 | - name: k8s_apiserver.admission_step_latency |
| 341 | description: Admission Step Latency |
| 342 | unit: milliseconds |
| 343 | chart_type: line |
| 344 | dimensions: |
| 345 | - name: validate |
| 346 | - name: admit |
| 347 | - name: k8s_apiserver.etcd_object_counts |
| 348 | description: Objects Stored In Etcd |
| 349 | unit: objects |
| 350 | chart_type: stacked |
| 351 | dimensions: |
| 352 | - name: a dimension per resource type |
| 353 | - name: k8s_apiserver.audit_events |
| 354 | description: API Server Audit Events |
| 355 | unit: events/s |
| 356 | chart_type: line |
| 357 | dimensions: |
| 358 | - name: events |
| 359 | - name: rejected |
| 360 | - name: k8s_apiserver.authentication_requests |
| 361 | description: API Server Authenticated Requests |
| 362 | unit: requests/s |
| 363 | chart_type: line |
| 364 | dimensions: |
| 365 | - name: authenticated |
| 366 | - name: k8s_apiserver.goroutines |
| 367 | description: Goroutines |
| 368 | unit: goroutines |
| 369 | chart_type: line |
| 370 | dimensions: |
| 371 | - name: goroutines |
| 372 | - name: k8s_apiserver.threads |
| 373 | description: OS Threads |
| 374 | unit: threads |
| 375 | chart_type: line |
| 376 | dimensions: |
| 377 | - name: threads |
| 378 | - name: k8s_apiserver.process_memory |
| 379 | description: Process Memory |
| 380 | unit: bytes |
| 381 | chart_type: stacked |
| 382 | dimensions: |
| 383 | - name: resident |
| 384 | - name: virtual |
| 385 | - name: k8s_apiserver.heap_memory |
| 386 | description: Go Heap Memory |
| 387 | unit: bytes |
| 388 | chart_type: stacked |
| 389 | dimensions: |
| 390 | - name: alloc |
| 391 | - name: inuse |
| 392 | - name: stack |
| 393 | - name: k8s_apiserver.gc_duration |
| 394 | description: GC Duration |
| 395 | unit: seconds |
| 396 | chart_type: line |
| 397 | dimensions: |
| 398 | - name: min |
| 399 | - name: p25 |
| 400 | - name: p50 |
| 401 | - name: p75 |
| 402 | - name: max |
| 403 | - name: k8s_apiserver.open_fds |
| 404 | description: Open File Descriptors |
| 405 | unit: file descriptors |
| 406 | chart_type: line |
| 407 | dimensions: |
| 408 | - name: open |
| 409 | - name: max |
| 410 | - name: k8s_apiserver.cpu_usage |
| 411 | description: CPU Usage |
| 412 | unit: seconds/s |
| 413 | chart_type: line |
| 414 | dimensions: |
| 415 | - name: cpu |
| 416 | - name: workqueue |
| 417 | description: These metrics refer to controller work queues. |
| 418 | labels: |
| 419 | - name: controller |
| 420 | description: Controller name |
| 421 | metrics: |
| 422 | - name: k8s_apiserver.workqueue_depth |
| 423 | description: Work Queue Depth |
| 424 | unit: items |
| 425 | chart_type: line |
| 426 | dimensions: |
| 427 | - name: depth |
| 428 | - name: k8s_apiserver.workqueue_latency |
| 429 | description: Work Queue Latency |
| 430 | unit: microseconds |
| 431 | chart_type: line |
| 432 | dimensions: |
| 433 | - name: p50 |
| 434 | - name: p90 |
| 435 | - name: p99 |
| 436 | - name: k8s_apiserver.workqueue_adds |
| 437 | description: Work Queue Adds |
| 438 | unit: items/s |
| 439 | chart_type: line |
| 440 | dimensions: |
| 441 | - name: adds |
| 442 | - name: retries |
| 443 | - name: k8s_apiserver.workqueue_duration |
| 444 | description: Work Queue Work Duration |
| 445 | unit: microseconds |
| 446 | chart_type: line |
| 447 | dimensions: |
| 448 | - name: p50 |
| 449 | - name: p90 |
| 450 | - name: p99 |
| 451 | - name: admission controller |
| 452 | description: These metrics refer to admission controllers. |
| 453 | labels: |
| 454 | - name: name |
| 455 | description: Admission controller name |
| 456 | metrics: |
| 457 | - name: k8s_apiserver.admission_controller_latency |
| 458 | description: Admission Controller Latency |
| 459 | unit: events/s |
| 460 | chart_type: heatmap |
| 461 | dimensions: |
| 462 | - name: 5ms |
| 463 | - name: 25ms |
| 464 | - name: 100ms |
| 465 | - name: 500ms |
| 466 | - name: 1s |
| 467 | - name: 2.5s |
| 468 | - name: +Inf |
| 469 | - name: admission webhook |
| 470 | description: These metrics refer to admission webhooks. |
| 471 | labels: |
| 472 | - name: name |
| 473 | description: Webhook name |
| 474 | metrics: |
| 475 | - name: k8s_apiserver.admission_webhook_latency |
| 476 | description: Admission Webhook Latency |
| 477 | unit: events/s |
| 478 | chart_type: heatmap |
| 479 | dimensions: |
| 480 | - name: 5ms |
| 481 | - name: 25ms |
| 482 | - name: 100ms |
| 483 | - name: 500ms |
| 484 | - name: 1s |
| 485 | - name: 2.5s |
| 486 | - name: +Inf |